Systems and methods for security association enabling make-before-break-roaming (MBBR)

Abstract

A system and method are provided for generating a pairwise transient key security association (PTKSA) by: providing a first media access control (MAC) address that is shared by multiple access points (APs), the first MAC address corresponding to an infrastructure comprising the multiple APs, and each AP of the multiple APs having a respective AP MAC address; providing a second MAC address to a station (STA); and establishing a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pairwise transit key (PTK) for the secure link, wherein the secure link is between the STA and the multiple APs.

What is claimed is: 
     
         1 . A method for generating a pairwise transient key security association (PTKSA) for a multi-link device (MLD) operating in a wireless network that supports multi-link operation (MLO) across multiple access points (APs) in a manner compatible with both Wi-Fi 7 and Wi-Fi 8 standards, the method comprising:
 providing a first media access control (MAC) address that is shared by multiple access points (APs), the first MAC address corresponding to an infrastructure comprising the multiple APs, and each AP of the multiple APs having a respective AP MAC address;   providing a second MAC address to a station (STA) that is a non-AP MLD; and   establishing a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pairwise transit key (PTK) for the secure link, wherein the secure link is between the STA and one or more of the multiple APs thereby enabling seamless security association for the STA across the multiple APs in the multi-link operation compliant with both Wi-Fi 7 and Wi-Fi 8 standards.   
     
     
         2 . The method of  claim 1 , wherein establishing the secure link between the STA and the infrastructure comprises:
 deriving a pairwise master key (PMK) using a simultaneous authentication of equals (SAE) method to establish a multi-link association between the STA and the infrastructure; and   using a 4-way handshake protocol between the STA and the infrastructure to derive the PTK based on the PMK, the first MAC address, and the second MAC address.   
     
     
         3 . The method of  claim 1 , wherein the infrastructure is a make-before-break-roaming (MBBR) infrastructure. 
     
     
         4 . The method of  claim 3 , further comprising setting up respective links between the STA and each AP of the one or more of the multiple APs using the PMK, the PTK, and a same packet number (PN) space. 
     
     
         5 . The method of  claim 3 , further comprising providing roaming among respective APs of the infrastructure while maintaining secure communication between the STA and the infrastructure without the STA deriving a new PTK for the secure communication. 
     
     
         6 . The method of  claim 1 , further comprising using the PTK for secure communications simultaneously between two or more APs of the multiple APs. 
     
     
         7 . The method of  claim 1 , further comprising:
 using the PTK to encrypt media access control protocol data units (MPDUs) transmitted from the STA to two or more APs of the multiple APs; or   using the PTK to decrypt MPDUs received at the STA from two or more APs of the multiple APs.   
     
     
         8 . A computing apparatus comprising:
 a processor; and   a memory storing instructions that, when executed by the processor, configure the apparatus to:
 provide a first media access control (MAC) address that is shared by multiple access points (APs), the first MAC address corresponding to an infrastructure comprising the multiple APs, and each AP of the multiple APs having a respective AP MAC address; 
 provide a second MAC address to a station (STA) that is a non-AP MLD; and 
 establish a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pairwise transit key (PTK) for the secure link, wherein the secure link is between the STA and one or more of the multiple APs thereby enabling seamless security association for the STA across the multiple APs in the multi-link operation compliant with both Wi-Fi 7 and Wi-Fi 8 standards. 
   
     
     
         9 . The computing apparatus of  claim 8 , wherein establishing the secure link between the STA and the infrastructure comprises:
 deriving a pairwise master key (PMK) using a simultaneous authentication of equals (SAE) method to establish a multi-link association between the STA and the infrastructure; and   using a 4-way handshake protocol between the STA and the infrastructure to derive the PTK based on the PMK, the first MAC address, and the second MAC address.   
     
     
         10 . The computing apparatus of  claim 8 , wherein the infrastructure is a make-before-break-roaming (MBBR) infrastructure. 
     
     
         11 . The computing apparatus of  claim 10 , when executed by the processor, the stored instructions further configure the apparatus to:
 set up respective links between the STA and each AP of the one or more of the multiple APs using the PMK, the PTK, and a same packet number (PN) space.   
     
     
         12 . The computing apparatus of  claim 10 , when executed by the processor, the stored instructions further configure the apparatus to:
 provide roaming among respective APs of the infrastructure while maintaining secure communication between the STA and the infrastructure without the STA deriving a new PTK for the secure communication.   
     
     
         13 . The computing apparatus of  claim 8 , when executed by the processor, the stored instructions further configure the apparatus to:
 use the PTK for secure communications simultaneously between two or more APs of the multiple APs.   
     
     
         14 . The computing apparatus of  claim 8 , when executed by the processor, the stored instructions further configure the apparatus to:
 use the PTK to encrypt media access control protocol data units (MPDUs) transmitted from the STA to two or more APs of the multiple APs; or   use the PTK to decrypt MPDUs received at the STA from two or more APs of the multiple APs.   
     
     
         15 . A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to:
 provide a first media access control (MAC) address that is shared by multiple access points (APs), the first MAC address corresponding to an infrastructure comprising the multiple APs, and each AP of the multiple APs having a respective AP MAC address;   provide a second MAC address to a station (STA) that is a non-AP MLD; and   establish a secure link between the STA and the infrastructure using the first MAC address and the second MAC address to derive a pairwise transit key (PTK) for the secure link, wherein the secure link is between the STA and one or more of the multiple APs thereby enabling seamless security association for the STA across the multiple APs in the multi-link operation compliant with both Wi-Fi 7 and Wi-Fi 8 standards.   
     
     
         16 . The non-transitory computer-readable storage medium of  claim 15 , wherein the infrastructure is a make-before-break-roaming (MBBR) infrastructure. 
     
     
         17 . The non-transitory computer-readable storage medium of  claim 16 , wherein, when executed by a computer, the instructions further cause the computer to:
 set up respective links between the STA and each AP of the one or more of the multiple APs using the PMK, the PTK, and a same packet number (PN) space.   
     
     
         18 . The non-transitory computer-readable storage medium of  claim 16 , wherein, when executed by a computer, the instructions further cause the computer to:
 provide roaming among respective APs of the infrastructure while maintaining secure communication between the STA and the infrastructure without the STA deriving a new PTK for the secure communication.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 15 , wherein, when executed by a computer, the instructions further cause the computer to:
 use the PTK for secure communications simultaneously between two or more APs of the multiple APs.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 15 , wherein establishing the secure link between the STA and the infrastructure comprises:
 deriving a pairwise master key (PMK) using a simultaneous authentication of equals (SAE) method to establish a multi-link association between the STA and the infrastructure; and   using a 4-way handshake protocol between the STA and the infrastructure to derive the PTK based on the PMK, the first MAC address, and the second MAC address.